Outbreak Alert: Citrix Bleed 2

[smallick]

FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence. Adversary Centric Intelligence (ACI): leverages FortiGuard Threat Analysis to provide comprehensive coverage of dark web, open-source, and technical threat intelligence, including threat actor insights to enable organizations to respond proactively assess risks, respond faster to incidents, better understand their attackers, and guard assets. The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.
CVE ID	CVE-2025-6543
CVE Title	Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.04011
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	3
Darknet Mention(s)	3 (exploit, ramp)
Telegram Mention(s)	4 (SecAtor)
FortiRecon Intelligence Reporting(s)	2 (OSINT)
Vendor Advisory:	https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788

CVE ID	CVE-2025-5777
CVE Title	Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
NVD Severity	HIGH
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.20329
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	17
Darknet Mention(s)	8 (exploit, ramp)
Telegram Mention(s)	6 (BugCrowd unofficial: Bug Bounty Hunting Discussion Group | HackerOne | Intigriti | YesWeHack | Yogosha |Synack, SecAtor)
FortiRecon Intelligence Reporting(s)	4 (OSINT)
Vendor Advisory:	https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-... https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixblee... https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-20... https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev/ https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/ https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71 https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-d...

CVE ID	CVE-2025-5349
CVE Title	Improper access control on the NetScaler Management Interface in NetScaler...
NVD Severity	Not Assigned
FortiRecon Severity	LOW
FortiRecon Score	26/100
Epss Score	0.00039
Exploited	No
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	No
Available working exploit(s)	0
Available POC exploit(s)	1
Darknet Mention(s)	0
Telegram Mention(s)	1 (SecAtor)
FortiRecon Intelligence Reporting(s)	2 (OSINT)
Vendor Advisory:	https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420